r-pak: prepare 0.11.1 update and add r-tstoml

[bshor]

Summary

Update pak, an R package installer and dependency resolver, from 0.9.5 to 0.11.1 and add its missing TOML-editing dependency, r-tstoml. The existing r-tsitter recipe is unchanged. One commit per package.

Draft: not ready to merge. Verification exposed a system-dependency compatibility blocker described below.

• Keep pak's existing system-library patch and test policy unchanged.
• Add r-tsitter and r-tstoml to pak's runtime dependencies and Lilac build ordering.
• Declare the additional packages used by pak's tests in checkdepends and repo_makedepends.
• Package tstoml 0.0.0.9000 from immutable upstream commit 548e2e71195906584b17ac0aa83e4d3edcef8da2, with a SHA-256 checksum and manual update tracking. It is not on CRAN and has no release tags; the published source asset still imports the obsolete ts package, while this source imports tsitter.

Verification

• Source verification passed for pak and tstoml.
• tstoml: local Arch Linux build passed; the extended test suite passed 299 checks with no failures, warnings, or skips. Dependencies were supplied through temporary R libraries, without system installation. This was not a clean-chroot build.
• pak: the existing patch applies and R CMD INSTALL succeeds. The unchanged test suite finishes with one error in test-ppm-sso.R and two upstream skips; makepkg therefore fails in check().
• YAML parsing and git diff whitespace checks passed.

Blocker / Review Question

The packaged and current CRAN pkgcache 2.2.5 has cran_app, but lacks ppm_sso_app, ppm_sso_login, ppm_sso_status, and ppm_sso_logout. Pak 0.11.1 bundles newer pkgcache code containing those functions, and its public SSO wrappers call them. With BioArchLinux's system-library patch, the SSO test errors with attempt to apply non-function.

This is not merely a missing test fixture: suppressing the test would leave the new SSO feature broken. Should this update wait for a compatible pkgcache release, or would you prefer a separately reviewed pkgcache backport/development-source update? No tests have been disabled and no shared dependency has been changed in this PR.